Runtime Additive Malware Disinfection via Remediation Component
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware disinfection methods often require deletion or modification of infected objects, potentially losing pre-existing content or being ineffective against unknown malware.
Innovation Solution
A method that identifies suspected malware-infected software applications, predicts the malware function based on known patterns, and adds a remediation software component to disable the predicted malicious function without modifying the existing code, allowing for additive disinfection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional malware disinfection methods are used (deletion or modification of infected objects), then malware functions are removed, but pre-existing content may be lost and the process is disruptive
Solution Approach 1:
The patent introduces a remediation software component as an intermediary layer between the user and the potentially infected executable. This component intercepts function calls and prevents malware execution without modifying the original executable file, thus preserving pre-existing content while still achieving malware removal effectiveness
Solution Approach 2:
The patent segments the disinfection process into two independent parts: the original executable file remains unchanged, while a separate remediation software component is added. This segmentation allows the malware removal function to be achieved without affecting the integrity of the original file and its pre-existing content
2Reliability
If traditional malware disinfection methods are used (deletion or modification), then malware is removed, but the process is complex and may fail against unknown malware
Solution Approach 1:
The remediation software component is designed with universal functionality that can handle both known and unknown malware through pattern prediction. Instead of requiring specific disinfection procedures for different malware types, the system uses a unified approach of adding function-disabling code based on predicted malware behavior, reducing process complexity
3Loss of substance
If additive remediation software component is added, then original content is preserved, but the system complexity increases
Solution Approach 1:
The system performs predictive analysis of malware functions automatically without requiring manual intervention or complex configuration. The remediation software component self-configures based on pattern matching and prediction algorithms, managing the increased system complexity through automated self-service mechanisms
Data Source
AI summary
In embodiments of the present invention improved capabilities are described for runtime additive disinfection of malware. Runtime additive disinfection of malware may include performing the steps of identifying, based at least in part on its type, an executable software application that is suspected of being infected with malware, wherein the malware is adapted to perform a function during the execution of the executable software application, predicting the malware function based on known patterns of malware infection relating to the type of the executable software application, and in response to the prediction, adding a remediation software component to the executable software application that disables the executable software component from executing code that performs the predicted malware function.